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(57) Abstract 

A novel system for controlling the inbound and outbound data packet flow in a computer network by which 
private networks can be secured from outside attacks. A user generates a rule base (400) which is converted into a set of 
filter language instructions where each rule includes a source, destination, service, whether to accept or reject the packet 
and whether to log the event. The filter language instructions are executed on inspection engines (204) on computers 
acting as firewalls (124) positioned in the network such that all traffic is forced to pass through the firewall. Packets are 
filtered in accordance with the rule base. The inspection engine acts as a virtual packet filter machine (600) determining 
whether to accept or reject a packet. If a packet is rejected, it is dropped, and if accepted may be modified. Modifications, 
performed in accordance with the rule base, may include encryption, decryption, signature generation or verification, or 
address translation. 
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